Collaborative Project: Puzzle-Based Cybersecurity Learning to Enhance Defensive Skills of Front-Line Technicians

合作项目：基于谜题的网络安全学习，以增强一线技术人员的防御技能

• 批准号: 1406992
• 负责人: Thomas Pigg
• 金额: $ 38.51万
• 依托单位: Jackson State Community College
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-09-01 至 2018-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1406992&HistoricalAwards=false
• 关键词: Collaborative; Project; Puzzle; Based; Cybersecurity

This is a collaborative project involving Jackson State Community College (Award DUE-1406992) and the University of Memphis (Award DUE-1406853).Keeping computers and information systems secure is a major challenge. Business, industry, and government need well-prepared technicians who can prevent, detect, and investigate cybersecurity breaches, and the growth of cyber-threats has created a need for many more workers who have appropriate, specific knowledge and skills. The objective of this project is to develop innovative "puzzles," using specialized software, to assist students in learning concepts of and approaches to cybersecurity. Every day, new cyber-attack patterns and vulnerabilities are emerging. Passive methods of cybersecurity education do not adequately prepare students to defend against rapidly evolving, real-world threats. The central idea behind puzzle-based learning is to provide interesting challenges that engage students in thinking about multiple approaches to solving a problem. Puzzles formulate a problem in a specific format that encourages students to use their knowledge and skills and to think "outside the box."The project team will design and develop interactive, multi-level puzzles both for students who have limited knowledge of computers, networks, and cybersecurity and for students who have a moderate to high level of expertise. The complexity of the developed puzzles will be varied based on the target audience. Puzzle-based learning addresses two issues: (1) It places emphasis on developing critical thinking skills instead of simply covering content. (2) It promotes and builds mathematical and logical reasoning skills. Many institutions have already used puzzles in their STEM curricula successfully. Puzzles have been introduced in introductory computer science courses. However, no significant work has been done on introducing puzzles into cybersecurity curricula. The project team will design scenario-based security puzzles that explore a range of topics (such as identifying and neutralizing malicious software, deploying a secure wireless network, and detecting e-mail spam) using logical decision trees, truth tables, and directed graphs. At the end of each exercise, participants will be able trace back their decisions and analyze how an incorrect decision stem can lead to the exploitation of a vulnerability and how correct actions can prevent it. The investigators will phase in the use of these puzzles so as to: i) examine how to effectively integrate such puzzle-based learning technology with instructional content of community college courses to improve the skill sets of front line cyber defenders, and ii) better identify and understand the circumstances under which success occurs. The project team will also conduct a small-scale efficacy study by having students participate in cyber "capture-the-flag" competitions to determine if the new enhanced courseware enables increased learning compared to the existing instructional methodology.

这是一个涉及杰克逊州立社区学院（奖项 DUE-1406992）和孟菲斯大学（奖项 DUE-1406853）的合作项目。保持计算机和信息系统的安全是一项重大挑战。企业、工业和政府需要准备充分的技术人员来预防、检测和调查网络安全漏洞，而网络威胁的增长需要更多拥有适当、特定知识和技能的工人。该项目的目标是使用专用软件开发创新的“谜题”，以帮助学生学习网络安全的概念和方法。每天，新的网络攻击模式和漏洞都在出现。被动的网络安全教育方法不足以让学生做好抵御快速发展的现实世界威胁的充分准备。基于谜题的学习背后的中心思想是提供有趣的挑战，让学生思考解决问题的多种方法。谜题以特定的形式提出问题，鼓励学生运用他们的知识和技能，并“跳出框框”思考。项目团队将为计算机、网络和网络安全知识有限的学生以及具有中等到高级专业知识的学生设计和开发交互式、多层次的谜题。所开发谜题的复杂性将根据目标受众的不同而有所不同。基于谜题的学习解决了两个问题：（1）它强调培养批判性思维技能，而不是简单地覆盖内容。 (2)促进和建立数学和逻辑推理能力。许多机构已经在其 STEM 课程中成功使用了谜题。计算机科学入门课程中引入了谜题。然而，在将难题引入网络安全课程方面尚未开展任何重大工作。项目团队将设计基于场景的安全难题，使用逻辑决策树、真值表和有向图来探索一系列主题（例如识别和消除恶意软件、部署安全无线网络以及检测垃圾电子邮件）。在每次练习结束时，参与者将能够追溯他们的决策，并分析错误的决策如何导致漏洞被利用，以及正确的行动如何防止漏洞被利用。研究人员将分阶段使用这些谜题，以便：i）研究如何有效地将这种基于谜题的学习技术与社区大学课程的教学内容相结合，以提高一线网络防御者的技能；ii）更好地识别和理解成功发生的情况。项目团队还将通过让学生参加网络“夺旗”竞赛来进行小规模功效研究，以确定与现有教学方法相比，新的增强课件是否能够提高学习效果。